Great comparision! Thak you! In my opinion you missed to mention one important thing about L2TP/IPsec. In Mikrotik environment is old issue that clients reaching the server via NAT do work but only one at a time per each public address.
@charalamposparlaloglou6863 Жыл бұрын
I Just deployed a wireguard mesh vpn network between 7 sites and many road warriors clients. Performance speed touches 98% of line bandwidth and latency is awesome .
@khwezidushu5 ай бұрын
Is Cisco anyconnect any different?
@netrionio1 Жыл бұрын
My man, my pro it teacher , I hail you and greetings from Greece! I have a fast internet connection but no access to public IP in my first WAN . My second WAN has slow internet connection and I have it as a backup. So Zerotier was a lifesaver ! I really admire you and I deeply appreciate what you do. Keep up the good work. Thumbs up!
@nezu_cc Жыл бұрын
Mikrotik for life. ZeroTier is awesome but It managed to bork itself on 2 of my production systems already (1 windows and 1 linux box). Rock solid of MT though. Wiregaurd is my go-to nowadays if I have a public IP accessible somewhere. Super fast, super simple, and using a modern stream cipher.
@Darkk6969 Жыл бұрын
Love Wireguard that I'm using in pfsense. I've always wondered how reliable and stable ZeroTier is since you're relying on their infrastructure. I rather run Wireguard myself on my own network so I wouldn't have to worry about cloud services going down.
@jembodo Жыл бұрын
Was using L2TP + IPsec because of native Mac and Windows support for a while until Wireguard came along. Now I primarily use Wireguard on MT and OpenVPN on another server as backup.
@pbrigham Жыл бұрын
ZeroTier here as well, the piece of mind of not having any ports open is just unbeatable.
@Anavllama Жыл бұрын
Zerotier is excellent if you have two endpoints (routers) that do not have publicly accessible IPs. Limits, yes ARM devices but also dependency on third party servers. It can handle complex scenarios and wide variety of needs. Wireguard is maybe a bit faster but its strength is relatively easy to setup and it is truly independent. Never used OPENVPN and will never see myself needing to use it and not completely implemented in MT OS anyway. Where things get interesting which no one addresses head on is the issue of MTU which manifests in no browsing, slow browsing or some website not reachable. For example in wirguard, ensure ICMP is not blocked first and foremost. One method to address this is to try putting the MTU from default 1420 to 1500 on both client and server ends, or mangle/MSS clamping on the client side, OR............ MRRU finessing by using an unencrypted L2TP tunnel within an encrypted wireguard tunnel to send ones data. L2TP settings allow MRRU through MLPPP. One uses the very basic L2TP settings and ensures MRRU is set at 1504 at both ends of the L2TP connection. Dont use pptp................. no reason to.
@Sean_Cockrell Жыл бұрын
SSTP was my preferred method for connecting multiple locations. Usually single digit pings end to end, might be because we were within the same ISP on each end. Now I quite like Zerotier (simplicity) and Wireguard (speed). However Zerotier can get more complex if you create flow rules and setup capability matrix in the web admin console
@TandSylvester Жыл бұрын
Thank you for the awesome video. Really appreciate the effort with the comparisons. Perhaps do show things like the IPIP, EoIP tunnels as well as the dynamic routing protocols. Really love the content and keep it going!!!!
@drumer2142 Жыл бұрын
Your video right on time for me. I was wondering what to use and because you have the experience I can tell that you know what you are talking about. Thanks you and keep up the good work !!!
@karlmarks9885 Жыл бұрын
Hello, Johnny! Appreciate your work and talent of presentation. May I kindly ask you to specify few things? 1. L2TP was tested with ipsec, right? 2. You wrote “Unable to test” for IKEv2 in a table. Do you mean - tests failed in browser? Did “speedtest”/”fast” webpages load with no errors? 3. I’ve noticed poor results for PPTP. Maybe you have some thoughts about it (despite of low CPU/memory requirements pptp loses to others)? Have you ever tried to establish PPTP tunnels from some other locations? Thank you so much in advance.
@steveb1739 Жыл бұрын
Thanks Meneer, very informative. Using Wireguard here in the UK, to access the office NAS from my phone, inter alia.
@kirksteinklauber260 Жыл бұрын
Nice video!! Any VPN using TCP will suffer what is called TCP meltdown (TCP inside from the app in another TCP like the VPN tunnel creates) that impacts badly the throughput so stay away of TCP VPNs such as SSTP or OVPN over TCP
@brandonbrand2338 Жыл бұрын
ZT Rocks man! It get's my vote indeed. Nice video Network Berg
@maaknlani1 Жыл бұрын
Hou nie van Mikrotik, but can't deny its a good product. Use raspberry with wireguard for port customizations.
@barnaczukor42352 ай бұрын
I want to connect two locations with VPN, but both lack the static IP address. However DDNS is working for both places and clients can connect to both routers easily. Can I use IPSEC with two DDNS enabled routers? If not, which protocol do you recommend for permament connection? Thanks for your answer.
@martinmasera8887 Жыл бұрын
Thank Berg for very nice video. I used Zerotier, but not happy with speed, only around 25Mbits.
@bandzo87 Жыл бұрын
Bcs I have CHR as main location I'm stuck with wireguard and cant complain. Works very well, but we will see how it hold hundreads off peers. For older V6 routers we still use l2tp but with ipsec.
@vedatyilmaz4577 Жыл бұрын
One more great, very informative video, thanks.
@RuhollahNoruzi Жыл бұрын
can you tell about install v2ray protocol on microtik? thanks
@Ripperua Жыл бұрын
@The Network Berg Hi there i've issue with L2TP+IPSEC latency +3-5ms compared to direct ping side to client plus little fluctuating +2-3ms. Is there any advices where to dig to?
@sayem4you6 ай бұрын
please make a IKE2 VPN server for android..because android now support only ike2 vpn. struggling to make a ike2 vpn server ...
@Richard-kl8wr Жыл бұрын
its possbiel to create sito to site via Wireguard ? for example to cloud ( Mikrotik - Linux Machine )
@TheNetworkBerg Жыл бұрын
Yes, totally viable and many people will do stuff like that
@thepcfd10 ай бұрын
can you make video how to make openvpn on miktorik in router os 7 with extracking ovpn file form it and ppp profile?
@ZagatoZee Жыл бұрын
Thanks for this. Makes me feel better about waiting for an ARM based MikroTik device for my primary usege. I have a MikroTik mAP (both lite and non lite versions actually) to play with while I wait on the Arm based AX models being available in my region. I'd like to setup a VPN that my friends in other countries can use to avoid region restrictions, but NOT give them any access to my home network. mAP would have to be behind an ISP modem. Is this possible? Is there an ELI5 guide for this anywhere? It seems that all VPN guides are for the (etirely normal) setup: secure access to the network. I just want it for geolocation avoidance - not local network access. Any pointers on how one could accomplish this?
@dhiaahmed5420 Жыл бұрын
Great information
@TheNetworkBerg Жыл бұрын
Glad you think so!
@AlirezaNikyar Жыл бұрын
Please teach about open VPN settings of ExpressVPN company on mikrotik
@brodie7838 Жыл бұрын
I had ZT fully working across 5 sites and it was amazing just like you said. Then I disabled the ZT interface in WinBox in one of the site configs and the whole thing suddenly tanked, and I've never been able to get it working again and been using SSTP in its place for now. I'm genuinely baffled.
@rolandomota7474 Жыл бұрын
did you figured out? maybe in the ZT forums somebody can help.
@ShaneFromSA Жыл бұрын
Can you run Zerotier and Wireguard on the same router at the same time? If I enable Zerotier package, wireguard no longer works.
@jankalisek5508 Жыл бұрын
Yes, you can. I have on my RB5009 2 instances of Zerotier (one for RoadWarriors and 1 as HUB-Spokes VPN) plus Wireguard as site-to-site VPN for older Mikrotik router.
@urZcszyYo3TMEDmW Жыл бұрын
Why mikrotik doesn't implement zerotier to other platforms other than ARM, any ideas?
@TheNetworkBerg Жыл бұрын
I honestly do not have any idea, I would have thought that at the very least that virtual devices like x86 or CHR would support it, maybe one day it will but only MikroTik can really answer it and on their forums they just state that there are no plans for Zerotier on any other architecture
@antoniomax3163 Жыл бұрын
pls more about sstp on mikrotik. also sert
@haydenbarker5049 Жыл бұрын
Hi there ! I was wondering if you were in a position to do a video, or comment on, the ability to do 2FA/MFA with Mikrotik VPN's. Websites like rublon and miniOrange seem to provide the services.
@TheNetworkBerg Жыл бұрын
Definitely an interesting topic, unfortunately I have never needed to deploy MFA to MikroTik VPN users in my own production network. But I would like to see if this can be done on MikroTik, perhaps with the aid of some scripting on it, it may be doable. If I do figure it out I will definitely make a video on the subject.
@haydenbarker5049 Жыл бұрын
@@TheNetworkBerg there is a free trial for MiniOrange with no credit card required... 2FA is becoming fairly standard request it would seem.
@haydenbarker5049 Жыл бұрын
@@TheNetworkBerg I need it for a client project coming up in January.. I'll do my best to keep you posted as well.. you have been of so much help to me !
@rolandomota7474 Жыл бұрын
can you connect to a sonicwall vpn ?
@TheNetworkBerg Жыл бұрын
You can definitely create VPN tunnels to Sonicwalls, IKEv2 should work just fine.
@creepr524 Жыл бұрын
ROS v7 sucks tho. It wont register OSPF LSAs from v6 devices :(
@rolandomota7474 Жыл бұрын
idk why mikrotik made ROS V7 not compatible with V6 ...that sux big time , some stuff do not play well between versions , i have friends who have big setups runing on V6 cause it is a PiTA to start over changing all net config if they upgrade to V7
@testaccount-xl3ki16 күн бұрын
ipsec will never go away. Everything support it😂
@netcip5 ай бұрын
The most garbage routers you can buy on the market.